--- a/msite.inc.php	Thu Nov 20 15:47:41 2014 +0200
+++ b/msite.inc.php	Thu Nov 20 16:35:15 2014 +0200
@@ -647,7 +647,43 @@
 
 function stMakePath($isURL, $repExt, $components)
 {
-  return implode("/", $components);
+  $res = array();
+
+  // If this is URL, the first component is passed as is
+  if ($isURL)
+  {
+    $res[] = array_shift($components);
+    $first = FALSE;
+  }
+  else
+    $first = TRUE;
+
+  // Handle each path component
+  foreach ($components as $subComponent)
+  {
+    foreach (explode("/", $subComponent) as $item)
+    {
+      if ($item == "..")
+        array_pop($res);
+      else
+      if ($item != "." && ($item != "" || $first))
+        $res[] = preg_replace("/[^a-zA-Z0-9\,\.\/_-]/", "_", $item);
+
+      $first = FALSE;
+    }
+  }
+
+  if ($repExt !== FALSE && ($tmp = array_pop($res)) !== false)
+  {
+    if (($spos = strrpos($tmp, ".")) !== FALSE)
+      $tmp = substr($tmp, 0, $spos).$repExt;
+    else
+      $tmp .= $repExt;
+
+    $res[] = $tmp;
+  }
+
+  return implode("/", $res);
 }